#!/bin/sh
# Pluto control daemon
# Copyright (C) 1998, 1999, 2001  Henry Spencer.
# Copyright (C) 2010-2013 Tuomo Soini <tis@foobar.fi>
# Copyright (C) 2012 Paul Wouters <paul@libreswan.org>
# 
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.

pidfile=@FINALVARDIR@/run/pluto/pluto.pid
verb="Starting"
for dummy; do
    case "$1" in
	--re)
	    verb="Restarting"
	    ;;
	--plutorestartoncrash)
	    plutorestartoncrash="$2"
	    shift
	    ;;
	--extraoptions)
	    PLUTO_OPTIONS="$2"
	    shift
	    ;;
	--)
	    shift
	    break
	    ;;
	-*)
	    echo "ipsec _plutorun: unknown option \`$1'" >&2
	    exit 2
	    ;;
	*)
	    break
	    ;;
    esac
    shift
done

# initially we are in the foreground, with parent looking after logging

# precautions
if [ -f ${pidfile} ]; then
    echo "pluto appears to be running already (\`$pidfile' exists), will not start another"
    exit 1
fi

logger "Plutorun started on "$(date)

# spin off into the background, with our own logging
echo "$verb Pluto subsystem..." | logger -p authpriv.error -t ipsec__plutorun
execdir=${IPSEC_EXECDIR:-@IPSEC_EXECDIR@}

# Work around problem with broken shells (e.g. Busybox sh).
# We are called with stdout & stderr going to a logger process started
# by "ipsec setup". For some reason, when the below loop runs with
# stdout & stderr redirected to a new logger, the pipe to the old logger
# is leaked through to _plutorun as file descriptor 11, and the old
# logger (and "ipsec setup") can never exit. By closing fds 1 & 2
# before they can be dup'd to 11, we somehow avoid the problem.
# This problem may also apply to Ubuntu's dash shell
# (http://archives.free.net.ph/message/20090803.221025.1b0ebafd.en.html)
# but the workaround has not been tested there.
exec 1>/dev/null
exec 2>/dev/null

until (
    # eval allows to contain redirection and other magic
    eval $execdir/pluto --config @FINALCONFFILE@ --nofork ${PLUTO_OPTIONS}
    status=$?
    echo "exit"
    echo $status
    ) 
do
    status=$?
    case "$status" in
    13)
	echo "internal failure in pluto scripts, impossible to carry on"
	exit 1
	;;
    10)
	echo "pluto apparently already running (?!?), giving up"
	exit 1
	;;
    137)
	echo "pluto killed by SIGKILL, terminating without restart or unlock"
	exit 0
	;;
    143)
	echo "pluto killed by SIGTERM, terminating without restart"
	# pluto now does its own unlock for this
	exit 0
	;;
    *)
	st=$status

	if [ $st -gt 128 ]; then
	    st="$st (signal $(expr $st - 128))"
	fi
	echo "!pluto failure!:  exited with error status $st"
	echo "restarting IPsec after pause..."
	(
	    sleep 10
	    # use start, not restart for now, due to module unloading/loading
	    ipsec setup start
	) </dev/null >/dev/null 2>&1 &
	exit 1
	;;
    esac
done </dev/null 2>&1 |
    logger -s -p daemon.error -t ipsec__plutorun >/dev/null 2>/dev/null &

exit 0
